spb/wp-spboucher-ai

1# Infrastructure discovery and compatibility report — wp.spboucher.ai (2026-11-02)23## What was found4| Item | Finding |5|---|---|6| DNS | `wp.spboucher.ai` → `A 51.161.112.61` (BHS64 gateway) already configured at GoDaddy. No change made, no duplicate created. |7| Public ingress | MacLustr Tunnel: WireGuard hub on BHS64 (`wg0` 10.67.0.1, UDP 443 fallback), Caddy with automatic TLS. Before deployment `https://wp.spboucher.ai` returned a TLS alert (no route). `mld deploy` adds the Caddy route `wp.spboucher.ai → M3U96b:8560` over `wg1`. |8| Deployment convention | `mld` on M1M32 (manifest `~/dispatch/apps/<app>.json`, staging, rsync, PM2, health check, tunnel route, registry). Templates: `tools-spboucher-ai` (Next 16 + Postgres 17 on M2M32c) and `akos` (M4M64c). |9| Nodes considered | M3U96b (28 c / 96 GB, Postgres 17.11, poppler, redis, 395 GB free, 2 apps), M4M64c (3 spboucher.ai apps already), M2M32c (tools), M2M32b (unreachable over Tailscale at discovery time). **Chosen: M3U96b** — isolation from other spboucher.ai apps, largest free disk for versioned manuscripts, Postgres already running. |10| PostgreSQL | 17.11 Homebrew on M3U96b; `pgvector` was missing → installed `pgvector 0.8.7` with Homebrew; extensions `vector`, `pg_trgm`, `unaccent`, `pgcrypto` created in a dedicated DB `wp_spboucher` with dedicated roles `wp_app` (read/write) and `wp_reader` (read-only on `public_*` views). Local-socket trust for the superuser; scram over TCP for app roles. |11| Storage | Local SSD, dedicated directory `~/data/wp-spboucher-ai/{files,previews,inbox,tmp}` (content-addressed by SHA-256). Backups `~/backups/wp-spboucher-ai` (encrypted) + rsync to M3U96a (LAN 192.168.2.80). No S3-compatible object store exists in the cluster; the layout is one `rclone`/`mc` sync away from one. |12| Monitoring / logging | PM2 (`pm2 logs`, `pm2-logrotate`), `mld heal` every 5 min on M1M32 (restarts PM2/launchd/wg1/routes), structured JSON logs from the worker, `GET /api/health` used by mld. Admin dashboard shows jobs, backups, AI status. |13| Authentication convention | Same pattern as tools.spboucher.ai: DB-backed sessions (`__Host-` cookie, HttpOnly, Strict), Argon2id, TOTP, CSRF double-submit, same-origin checks, login rate limiting, audit log. |14| AI | OpenAI `text-embedding-3-small` (1536 dims) — model existence verified at runtime with `GET /v1/models/{id}` before first use; disabled automatically if the key or model is unavailable. No LLM generation is used for metadata. |1516## Isolation guarantees17Dedicated DB, roles, PM2 process names (`wp-web`, `wp-worker`), port 8560 (free on M3U96b), storage and backup directories, `.env`. No change to other apps, other `spboucher.ai` subdomains, research databases or tunnel routes.1819## Source manuscripts20The 39 public manuscripts were taken from the already-public catalog of www.spboucher.ai (M2U64 `~/spboucher-ai/public/papers`, 44 MB) together with their verified metadata (`lib/research.ts`, `lib/research-details.ts`, written from the PDFs on 2026-11-01). WP39 and WP40 exist only as drafts in `~/Desktop/UQO/Recherche/Recherche-UQO` (no compiled manuscript): registered as **reserved** identifiers, not public.21